Restricting Biometric FIDO2 Key Access to a Single Windows PC/Browser

Secure Passwordless Authentication with FIDO2 Security Key

FIDO2 security keys with biometric authentication enables user-attributability and offer a strong, passwordless authentication mechanism. However, sensitive organizations such as the healthcare sector require stricter access controls to ensure that these keys can only be used on a specific Windows PC or browser. This prevents unauthorized use on other machines or browsers, enhancing security.

In this blog, we’ll explore how to enforce this restriction using the XSense IdP Server platform and the ThinC-AUTH biometric FIDO2 security key.

Why Restrict FIDO2 Key Access to One-User One-System/Browser?

While biometric FIDO2 keys provide high security, allowing them to be used on multiple devices or browsers can pose risks such as:

Data Breaches: Prevents users from accessing sensitive healthcare data from unapproved devices or browsers.
Regulatory Compliance: Healthcare and other sensitive industries must enforce strict authentication policies to meet legal and security requirements.

By binding a biometric FIDO2 key to a specific PC and browser, organizations can effectively mitigate these risks and implement "One-User One-PC" accessibility.

💡The Solution: Restricting Access Using XSense IdP Server & ThinC-AUTH

1. XSense IdP/AMS Server for Identity and Access Management

The XSense IdP Server provides a centralized authentication framework that allows organizations to enforce device and browser-specific authentication policies. It can:
- Bind FIDO2 key registration to a specific Windows PC and browser.
  Enforce device trust policies for secure access.
  Prevent FIDO2 key usage on unauthorized systems.
2. XSense (AMS) Agent for User Workstation
- The XSense (AMS) Agent is a standalone application service that will installed on the User Workstation. It performs:
- ✅ Computes the SystemID of the User Workstation.
  ✅ Validates FIDO2 Key Serial Number with the XSense IdP/AMS Server for the logged-in User Account.
3. ThinC-AUTH Biometric FIDO2 Key for User Authentication
- ThinC-AUTH is a FIDO2-certified biometric security key that ensures only the registered user can authenticate. It supports:
  ✅ Local Biometric Authentication: Ensuring the User to physically authenticating on to the Fingerprint Sensor on the FIDO2 Key. The sensor works only with live fingerprint templates and protects from any spoofed fingerprint for authentication.
  ✅ Device & Browser Binding: Can be configured to work only with a specific Windows PC and browser.
  ✅ Hardware-Based Security: Prevents Key cloning or unauthorized duplication.

💡The Solution: Continuous Connectivity Verification of FIDO2 Key

Implementation Steps

Step 1: Configure XSense IdP/AMS Server Policies

1. Enable Secure Authentication with FIDO2 Key: Configure the XSense Server to allow FIDO2 Key based authentication to the specific Windows PC.‍
2. Enforce MFA and Biometric Checks: Ensure that the FIDO2 authentication is mandatory with the ThinC-AUTH Biometric Key.

Step 2: Register ThinC-AUTH Key on a Specific Windows PC

1. Connect the ThinC-AUTH biometric FIDO2 key to the designated User Workstation.
2. Controlled Environment for Enrolling User Fingerprints: Provide a controlled environment to enroll User Fingerprint(s) on to the assigned Biometric FIDO2 Key.
3. Enable Device Binding: Using XSense Agent on the User Workstation, compute the SystemID and bind it with the User's ThinC-AUTH Biometric FIDO2 Key.

The Future of Passwordless Authentication

As organizations move towards passwordless authentication, features like continuous connectivity verification will be essential for securing user access, maintaining compliance, and preventing security breaches.

With Ensurity’s XSense Server and biometric FIDO2 security keys, organizations can fortify their authentication systems while ensuring seamless and secure user experiences.

The Future of Passwordless Authentication

🔒 Experience Uncompromized Security 🔒

Looking for a secure and efficient way to prevent simultaneous logins with FIDO2 security keys? 
Discover how Ensurity’s solutions can safeguard your systems while enhancing user convenience.

Restricting Biometric FIDO2 Key Access to a Single Windows PC/Browser

Table of Contents

Secure Passwordless Authentication with FIDO2 Security Key

Why Restrict FIDO2 Key Access to One-User One-System/Browser?

“In a world where passwords are the weakest link, we chose strength.
With FIDO2, authentication isn’t just secure-it’s effortless.  
One touch, one key, and our teams are in. No phishing. No resets. Just trust.”

💡The Solution: Restricting Access Using XSense IdP Server & ThinC-AUTH

Implementation Steps

Step 2: Register ThinC-AUTH Key on a Specific Windows PC

The Future of Passwordless Authentication

🔒 Experience Uncompromized Security 🔒

Explore our Recent Blogs

Restricting Biometric FIDO2 Key Access to a Single Windows PC/Browser

Table of Contents

Secure Passwordless Authentication with FIDO2 Security Key

Why Restrict FIDO2 Key Access to One-User One-System/Browser?

“In a world where passwords are the weakest link, we chose strength.With FIDO2, authentication isn’t just secure-it’s effortless. One touch, one key, and our teams are in. No phishing. No resets. Just trust.”

💡The Solution: Restricting Access Using XSense IdP Server & ThinC-AUTH

Implementation Steps

Step 2: Register ThinC-AUTH Key on a Specific Windows PC

The Future of Passwordless Authentication

🔒 Experience Uncompromized Security 🔒

Explore our Recent Blogs

“In a world where passwords are the weakest link, we chose strength.
With FIDO2, authentication isn’t just secure-it’s effortless.  
One touch, one key, and our teams are in. No phishing. No resets. Just trust.”